OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" | 5 #include "sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.h" |
6 | 6 |
7 #include <errno.h> | 7 #include <errno.h> |
8 #include <fcntl.h> | 8 #include <fcntl.h> |
9 #include <fcntl.h> | 9 #include <fcntl.h> |
10 #include <linux/net.h> | 10 #include <linux/net.h> |
(...skipping 34 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
45 // https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/priv
ate/bionic_prctl.h | 45 // https://android.googlesource.com/platform/bionic/+/lollipop-release/libc/priv
ate/bionic_prctl.h |
46 #if !defined(PR_SET_VMA) | 46 #if !defined(PR_SET_VMA) |
47 #define PR_SET_VMA 0x53564d41 | 47 #define PR_SET_VMA 0x53564d41 |
48 #endif | 48 #endif |
49 | 49 |
50 // https://android.googlesource.com/platform/system/core/+/lollipop-release/libc
utils/sched_policy.c | 50 // https://android.googlesource.com/platform/system/core/+/lollipop-release/libc
utils/sched_policy.c |
51 #if !defined(PR_SET_TIMERSLACK_PID) | 51 #if !defined(PR_SET_TIMERSLACK_PID) |
52 #define PR_SET_TIMERSLACK_PID 41 | 52 #define PR_SET_TIMERSLACK_PID 41 |
53 #endif | 53 #endif |
54 | 54 |
| 55 #ifndef PR_SET_PTRACER |
| 56 #define PR_SET_PTRACER 0x59616d61 |
| 57 #endif |
| 58 |
55 #endif // defined(OS_ANDROID) | 59 #endif // defined(OS_ANDROID) |
56 | 60 |
57 #if defined(__arm__) && !defined(MAP_STACK) | 61 #if defined(__arm__) && !defined(MAP_STACK) |
58 #define MAP_STACK 0x20000 // Daisy build environment has old headers. | 62 #define MAP_STACK 0x20000 // Daisy build environment has old headers. |
59 #endif | 63 #endif |
60 | 64 |
61 #if defined(__mips__) && !defined(MAP_STACK) | 65 #if defined(__mips__) && !defined(MAP_STACK) |
62 #define MAP_STACK 0x40000 | 66 #define MAP_STACK 0x40000 |
63 #endif | 67 #endif |
64 namespace { | 68 namespace { |
(...skipping 71 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
136 } | 140 } |
137 | 141 |
138 ResultExpr RestrictPrctl() { | 142 ResultExpr RestrictPrctl() { |
139 // Will need to add seccomp compositing in the future. PR_SET_PTRACER is | 143 // Will need to add seccomp compositing in the future. PR_SET_PTRACER is |
140 // used by breakpad but not needed anymore. | 144 // used by breakpad but not needed anymore. |
141 const Arg<int> option(0); | 145 const Arg<int> option(0); |
142 return Switch(option) | 146 return Switch(option) |
143 .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE | 147 .CASES((PR_GET_NAME, PR_SET_NAME, PR_GET_DUMPABLE, PR_SET_DUMPABLE |
144 #if defined(OS_ANDROID) | 148 #if defined(OS_ANDROID) |
145 , | 149 , |
146 PR_SET_VMA, PR_SET_TIMERSLACK_PID | 150 PR_SET_VMA, PR_SET_TIMERSLACK_PID, PR_SET_PTRACER |
147 #endif | 151 #endif |
148 ), | 152 ), |
149 Allow()) | 153 Allow()) |
150 .Default(CrashSIGSYSPrctl()); | 154 .Default(CrashSIGSYSPrctl()); |
151 } | 155 } |
152 | 156 |
153 ResultExpr RestrictIoctl() { | 157 ResultExpr RestrictIoctl() { |
154 const Arg<int> request(1); | 158 const Arg<int> request(1); |
155 return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default( | 159 return Switch(request).CASES((TCGETS, FIONREAD), Allow()).Default( |
156 CrashSIGSYSIoctl()); | 160 CrashSIGSYSIoctl()); |
(...skipping 148 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
305 static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit"); | 309 static_assert(4 == sizeof(clockid_t), "clockid_t is not 32bit"); |
306 const Arg<clockid_t> clockid(0); | 310 const Arg<clockid_t> clockid(0); |
307 return Switch(clockid) | 311 return Switch(clockid) |
308 .CASES((CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_PROCESS_CPUTIME_ID, | 312 .CASES((CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_PROCESS_CPUTIME_ID, |
309 CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_THREAD_CPUTIME_ID), | 313 CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_THREAD_CPUTIME_ID), |
310 Allow()) | 314 Allow()) |
311 .Default(CrashSIGSYS()); | 315 .Default(CrashSIGSYS()); |
312 } | 316 } |
313 | 317 |
314 } // namespace sandbox. | 318 } // namespace sandbox. |
OLD | NEW |